d:\cm\build\public\cool_win32_x86_4_6_8j\cool\dist\Win32\release\coolcore46.pdb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28d3f97d8a6756d9b8f478f465277c8b_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
28d3f97d8a6756d9b8f478f465277c8b_JaffaCakes118.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
28d3f97d8a6756d9b8f478f465277c8b_JaffaCakes118
-
Size
840KB
-
MD5
28d3f97d8a6756d9b8f478f465277c8b
-
SHA1
02f67ed53487e991a07b1dbee33db3f1341762c1
-
SHA256
4664bf2f303e97ac5a9442d201ca30e01b2fb8a6c7a83ed5d921e561a17c3437
-
SHA512
f3496ab2d944523baf01f38bff92586ef7962aec66aaaf31105c2d934d39d95e59a0d91ba74ab0ee1a051fbc98fd20a8100b76d6964cead539e360d4424585d5
-
SSDEEP
24576:SvnImr1gCVYxHnt0NvMveLYHgKn4J9VZrvsyNWAHeKlUUMIej8y:QnImr17YxHnt0NvMveL869VZr1NWAtE
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28d3f97d8a6756d9b8f478f465277c8b_JaffaCakes118
Files
-
28d3f97d8a6756d9b8f478f465277c8b_JaffaCakes118.dll windows:4 windows x86 arch:x86
82baa3865ab60b4328f11ed6ac50bc5f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
xprt5
?RemoveAt@TPtrArray@XPRT@@QAEXHH@Z
?Append@TPtrArray@XPRT@@QAEHABV12@@Z
??1TPtrList@XPRT@@QAE@XZ
??0TPtrList@XPRT@@QAE@H@Z
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
xprt_uintlen
xprt_intlen
_XprtStringLen@4
_XprtStringUtf8ByteLen@8
kUnicodeEncoding
kUtf8Encoding
kLatin1Encoding
kAsciiEncoding
?IsEmpty@TBstr@XPRT@@QBE_NXZ
_XprtFlipMem@8
kEnglishLanguage
?GetBestEncoding@TBstr@XPRT@@QBE?AV12@XZ
_XprtBinToBase64@16
??0TBstr@XPRT@@QAE@PBGH@Z
_XprtUtf8ToString@16
_XprtBase64ToBin@12
xprt_iswdigit
?GetAt@TBstr@XPRT@@QBEGH@Z
?Format@TBstr@XPRT@@QAAXPBGZZ
_XprtGetMilliseconds@0
??0TShaDigest@XPRT@@QAE@XZ
??0TMd4Digest@XPRT@@QAE@H@Z
?Set@TTime@XPRT@@QAEXPBG@Z
?GetTime64@TTime@XPRT@@QBE_JXZ
?Finish@TShaDigest@XPRT@@UAEHPAEH@Z
?SetIv@TBlockCipher@XPRT@@QAEXPBE@Z
?SetOp@TCipher@XPRT@@QAEXW4ECipherOp@12@@Z
_XprtGenerateRandom@8
xprt_time
?SetMode@TBlockCipher@XPRT@@QAEXW4ECipherMode@12@@Z
??1TCipher@XPRT@@UAE@XZ
?ProcessData@TBlockCipher@XPRT@@UAEHPAEH_N@Z
?GetType@TBlockCipher@XPRT@@UAE?AW4ECipherType@TCipher@2@XZ
??0TBlockCipher@XPRT@@QAE@W4ECipherOp@TCipher@1@@Z
??0TCipher@XPRT@@QAE@W4ECipherOp@01@@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@G@Z
?SetAt@TBstr@XPRT@@QAEXHG@Z
_XprtCompareVersionsA@8
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
_XprtGetDelayLoadRoot@0
?MakeBigEndian@TBstr@XPRT@@QAEAAV12@XZ
?kDirectorySeparator@TFile@XPRT@@2GB
??1TConvertFromUcs2@XPRT@@QAE@XZ
??0TConvertFromUcs2@XPRT@@QAE@PBG0@Z
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
_XprtUrlEncode@8
_XprtUrlDecode@8
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Find@TBstr@XPRT@@QBEHPBGH@Z
?ToInt@TBstr@XPRT@@QBEHH@Z
?Insert@TBstr@XPRT@@QAEHHPBG@Z
xprt_strtol
xprt_strncmp
xprt_strstr
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?FindIndex@TPtrList@XPRT@@QBEPAU__POSITION@2@H@Z
xprt_isspace
xprt_strtok
xprt_strchr
xprt_toupper
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
xprt_wcstol
?InsertBefore@TPtrList@XPRT@@QAEPAU__POSITION@2@PAU32@PAX@Z
?Tokenize@TBstr@XPRT@@QBE?AV12@PBGAAH@Z
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
_XprtHashFile@16
??0TSha256Digest@XPRT@@QAE@XZ
xprt_abs
?AddHead@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
_XprtInetNtoA@8
_XprtInetParse@16
?Delete@TBstr@XPRT@@QAEHHH@Z
_XprtGetMicroseconds@0
_XprtStringEncodedByteLen@12
kGsmEncoding
_XprtAolToIsoEncoding@8
_XprtIsoToAolEncoding@8
?Lookup@TPtrFromPtrMap@XPRT@@QAEPAVTPair@12@PAX@Z
?Finish@THmac@XPRT@@QAEHPAEH@Z
?Update@THmac@XPRT@@QAEXPBEH@Z
??0THmac@XPRT@@QAE@AAVTMessageDigest@1@PBEH@Z
xprt_wcscmp
?Set@TTime@XPRT@@QAEXN@Z
?Init@TFileInfo@XPRT@@IAEXPBGI_JABVTTime@2@22@Z
?SetLastWriteTime@TFile@XPRT@@SA_NPBGABVTTime@2@@Z
?GetInfo@TFile@XPRT@@SA_NPBGAAVTFileInfo@2@@Z
_XprtComputeChecksum@8
?GetString@TBstr@XPRT@@QBEPBGXZ
_XprtHashNormal@4
?FindValue@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAXPAU32@@Z
?Remove@TBstr@XPRT@@QAEHG@Z
kTextMimeType
xprt_wcsnicmp
_XprtAolToIsoLang@8
_XprtIsoToAolLang@8
kTextAolRtfMimeType
?FormatGmt@TTime@XPRT@@QBE?AVTBstr@2@PBG@Z
_XprtCreateThread@8
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?Replace@TBstr@XPRT@@QAEHPBG0@Z
?MakeLower@TBstr@XPRT@@QAEAAV12@XZ
xprt_pow
kTextPlainMimeType
??1TFileFinder@XPRT@@UAE@XZ
?Remove@TFile@XPRT@@SA_NPBG@Z
?FindNext@TFileFinder@XPRT@@QAE_NI@Z
?GetFileSpec@TFileFinder@XPRT@@QBE?AVTBstr@2@XZ
?Find@TFileFinder@XPRT@@QAE_NPBGI@Z
??0TFileFinder@XPRT@@QAE@XZ
?CompareNoCase@TBstr@XPRT@@QBEHPBG@Z
?Replace@TBstr@XPRT@@QAEHGG@Z
?CanonicalizeSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?ReverseFind@TBstr@XPRT@@QBEHG@Z
_XprtInetIsNonroutable@4
?Right@TBstr@XPRT@@QBE?AV12@H@Z
_XprtInetIsValid@4
?Find@TPtrArray@XPRT@@QBEHPAXH@Z
?RemoveAtPos@TPtrFromPtrMap@XPRT@@QAEXPAU__POSITION@2@@Z
xprt_wcsrchr
?MakeValidSpec@TFile@XPRT@@SA?AVTBstr@2@PBG_N@Z
?GetMonth@TTime@XPRT@@QBEHXZ
?GetDay@TTime@XPRT@@QBEHXZ
?GetYear@TTime@XPRT@@QBEHXZ
?GetHour@TTime@XPRT@@QBEHXZ
?GetMinute@TTime@XPRT@@QBEHXZ
?RemoveTrailingSeparator@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?FileNameFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AddTrailingSeparator@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?CreateTempFileSpec@TFile@XPRT@@SA?AVTBstr@2@XZ
?Insert@TBstr@XPRT@@QAEHHG@Z
??1TBufferedFile@XPRT@@UAE@XZ
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
??0TBufferedFile@XPRT@@QAE@H@Z
??0TInetChecksum@XPRT@@QAE@XZ
?Finish@TInetChecksum@XPRT@@QAEGXZ
?SetCurrent@TInetChecksum@XPRT@@QAEXGH@Z
?Update@TInetChecksum@XPRT@@QAEXPBEH@Z
?Finish@TCrc32Digest@XPRT@@QAEIXZ
??0TCrc32Digest@XPRT@@QAE@XZ
_XprtDestroyThread@8
_XprtCompareWildcard@8
xprt_iswalpha
xprt_iswalnum
xprt_wcsncmp
?Assign@TBstr@XPRT@@QAEAAV12@PBGH@Z
_XprtBinToHex@16
??1TMemStream@XPRT@@UAE@XZ
??1TXmlDeserializer@XPRT@@UAE@XZ
?Deserialize@TXmlSerializable@XPRT@@QAE_NAAVTXmlDeserializer@2@@Z
??0TXmlDeserializer@XPRT@@QAE@AAVTStream@1@@Z
??0TMemStream@XPRT@@QAE@PBXH@Z
??1TXmlWriter@XPRT@@UAE@XZ
?GetData@TMemStream@XPRT@@QBEPBXXZ
?GetLength@TMemStream@XPRT@@UBE_JXZ
?WriteEndDocument@TXmlWriter@XPRT@@QAE_NXZ
?Serialize@TXmlSerializable@XPRT@@QBE_NAAVTXmlWriter@2@@Z
?WriteStartDocument@TXmlWriter@XPRT@@QAE_NXZ
??0TXmlWriter@XPRT@@QAE@AAVTStream@1@@Z
??0TMemStream@XPRT@@QAE@XZ
?OnExternalEntityRef@TXmlParser@XPRT@@MAE_NPBD000@Z
?OnDefault@TXmlParser@XPRT@@MAEXPBDH@Z
?OnEndCdataSection@TXmlParser@XPRT@@MAEXXZ
?OnStartCdataSection@TXmlParser@XPRT@@MAEXXZ
?OnComment@TXmlParser@XPRT@@MAEXPBD@Z
?OnCharacterData@TXmlParser@XPRT@@MAEXPBDH@Z
?OnEndElement@TXmlParser@XPRT@@MAEXPBD0@Z
?OnProcessingInstruction@TXmlParser@XPRT@@MAEXPBD0@Z
??0TXmlParser@XPRT@@QAE@AAVTStream@1@@Z
?Go@TXmlParser@XPRT@@QAE_NXZ
?Stop@TXmlParser@XPRT@@QAEXXZ
??1TXmlParser@XPRT@@UAE@XZ
xprt_strcmp
?SetPosition@TMemStream@XPRT@@UAE_N_JH@Z
_XprtGetSystemInfo@0
?Assign@TBstr@XPRT@@QAEAAV12@PBDHPBG@Z
xprt_isdigit
??1TZipArchive@XPRT@@UAE@XZ
?ExtractAt@TZipArchive@XPRT@@UAEPAVTStream@2@PAU__POSITION@2@@Z
?Find@TZipArchive@XPRT@@UAEPAU__POSITION@2@PBG@Z
??0TZipArchive@XPRT@@QAE@AAVTStream@1@@Z
?GetTempDirectory@TFile@XPRT@@SA?AVTBstr@2@XZ
xprt_strlcat
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?MakeUpper@TBstr@XPRT@@QAEAAV12@XZ
??0TLibrary@XPRT@@QAE@XZ
?Load@TLibrary@XPRT@@QAE_NPBG@Z
?GetProcAddress@TLibrary@XPRT@@QBEP6GHXZPBD@Z
??1TLibrary@XPRT@@UAE@XZ
??0TBstr@XPRT@@QAE@PBG@Z
??1TBstr@XPRT@@QAE@XZ
_XprtPostMessage@16
xprt_ucslcpy
xprt_wcslen
xprt_strlen
_XprtFreeString@4
_XprtAtomicDecrement@4
_XprtAtomicIncrement@4
_XprtUnicodeToMultibyte@16
_XprtMultibyteToUnicode@16
?Term@TCritSec@XPRT@@QAEXXZ
?GetNextValue@TPtrFromPtrMap@XPRT@@QAEAAPAXAAPAU__POSITION@2@@Z
_XprtInetAtoN@12
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?Read@TFile@XPRT@@UAEHPAXH@Z
?CompareNormal@TBstr@XPRT@@QBEHPBG@Z
?RemoveAll@TPtrList@XPRT@@QAEXXZ
?GetBstrPtr@TBstr@XPRT@@QAEPAPAGXZ
?Normalize@TBstr@XPRT@@QAEAAV12@XZ
?RemoveAt@TPtrList@XPRT@@QAEXPAU__POSITION@2@@Z
?Find@TPtrList@XPRT@@QBEPAU__POSITION@2@PAXPAU32@@Z
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?GetLength@TBstr@XPRT@@QBEHXZ
_XprtStringToUtf8@16
xprt_isalnum
xprt_tolower
xprt_strlcpy
?Write@TFile@XPRT@@UAEHPBXH@Z
??0TMd5Digest@XPRT@@QAE@H@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
xprt_snprintf
?kLibraryExtension@TLibrary@XPRT@@2QBGB
?AppendFormat@TBstr@XPRT@@QAAXPBGZZ
xprt_wcsicmp
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
_XprtMemFree@4
_XprtMemAlloc@4
?InsertAt@TPtrArray@XPRT@@QAEXHPAXH@Z
?Copy@TPtrArray@XPRT@@QAEXABV12@@Z
??0TTimer@XPRT@@QAE@XZ
?SetCallback@TTimer@XPRT@@QAEXPAVTTimerCallback@2@@Z
?Stop@TTimer@XPRT@@QAEXXZ
?IsRunning@TTimer@XPRT@@QBE_NXZ
?Start@TTimer@XPRT@@QAE_NH_N@Z
??1TTimer@XPRT@@UAE@XZ
xprt_rand
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@G@Z
?Empty@TBstr@XPRT@@QAEXXZ
??0TFile@XPRT@@QAE@XZ
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
?GetLength@TFile@XPRT@@UBE_JXZ
??1TFile@XPRT@@UAE@XZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@PBDHPBG@Z
xprt_memcpy
??0TBstr@XPRT@@QAE@ABV01@@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
xprt_memmove
?Add@TPtrArray@XPRT@@QAEHPAX@Z
??0TPtrArray@XPRT@@QAE@XZ
xprt_memset
?Copy@TBstr@XPRT@@QBEPAGXZ
?FreeDataChain@SPlex@XPRT@@QAEXXZ
??1TPtrArray@XPRT@@QAE@XZ
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
?GetTimeZoneOffset@TTime@XPRT@@SA?AVTTimeSpan@2@ABV12@@Z
xprt_snwprintf
xprt_wcstoul
_XprtUninitialize@0
_XprtInitialize@8
?Unlock@TSpinLockRE@XPRT@@QAEXXZ
?Lock@TSpinLockRE@XPRT@@QAEXXZ
_XprtMemRealloc@8
?GetNext@TPtrFromPtrMap@XPRT@@QBEPBVTPair@12@AAPAU__POSITION@2@@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
??0TBstr@XPRT@@QAE@XZ
_XprtUnregisterMessageCallback@4
_XprtReleaseMessageId@4
?GetFileSpec@TLibrary@XPRT@@QBEABVTBstr@2@XZ
??2TXprtAllocated@XPRT@@SAPAXI@Z
_XprtHashString@4
_XprtCompareString@8
??3TXprtAllocated@XPRT@@SAXPAX@Z
_XprtGetMessageQueue@0
_XprtRequestMessageId@0
_XprtRegisterMessageCallback@8
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?VAdoptKey@TPtrFromGuidMap@XPRT@@MBEPAXPAX@Z
?VOrphanKey@TPtrFromGuidMap@XPRT@@MBEXPAX@Z
?VCompareKeys@TPtrFromGuidMap@XPRT@@MBEHPBX0@Z
?VHashKey@TPtrFromGuidMap@XPRT@@MBEIPBX@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?Attach@TBstr@XPRT@@QAEXPAG@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
_XprtAllocString@4
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?CreatePath@TFile@XPRT@@SA_NPBG@Z
?Free@TLibrary@XPRT@@QAE_NXZ
?Init@TCritSec@XPRT@@QAEXXZ
kSystemEncoding
??0TBstr@XPRT@@QAE@PBDPBG@Z
_XprtCompareNormal@8
xprt_memcmp
kernel32
LocalAlloc
InterlockedExchange
RaiseException
GetModuleHandleA
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
lstrcpyA
DisableThreadLibraryCalls
WaitForSingleObject
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
ExitProcess
GetLastError
user32
DispatchMessageA
SetParent
FindWindowExA
LoadStringA
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
ole32
CoCreateInstance
CoUninitialize
CoDisconnectObject
ProgIDFromCLSID
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoUnmarshalInterface
CreateStreamOnHGlobal
CoMarshalInterface
CoReleaseMarshalData
CoInitialize
oleaut32
SafeArrayGetUBound
SafeArrayCreate
SafeArrayDestroy
SafeArrayCopy
SafeArrayRedim
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayLock
SafeArrayUnlock
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElemsize
VariantInit
VariantClear
VariantCopy
VariantChangeType
LoadRegTypeLi
LoadTypeLibEx
SysStringLen
SetErrorInfo
SysAllocString
LoadTypeLi
RegisterTypeLi
GetErrorInfo
CreateErrorInfo
wsock32
htonl
WSAGetLastError
send
connect
htons
sendto
socket
bind
setsockopt
inet_ntoa
WSACleanup
ntohs
inet_addr
getsockname
getpeername
recvfrom
WSAAsyncSelect
WSAStartup
recv
closesocket
listen
accept
gethostbyname
gethostname
WSAAsyncGetHostByName
WSACancelAsyncRequest
iphlpapi
GetIpAddrTable
NotifyAddrChange
Exports
Exports
_XpcsCLSIDFromString@8
_XpcsCreateErrorInfo@4
_XpcsCreateInstance@20
_XpcsCreateSimpleInstance@12
_XpcsEnumRegistrations@8
_XpcsFreeUnusedLibraries@0
_XpcsGetClassObject@20
_XpcsGetErrorInfo@4
_XpcsGetSimpleClassFactory@8
_XpcsInitialize@4
_XpcsInitializeEx@12
_XpcsLoadTypeLib@8
_XpcsPostMessage2@8
_XpcsPostMessage@4
_XpcsRegisterClass@8
_XpcsRegisterClassObject@8
_XpcsRegisterServer@4
_XpcsSafeArrayAccessData@8
_XpcsSafeArrayCopy@8
_XpcsSafeArrayCreate@12
_XpcsSafeArrayDestroy@4
_XpcsSafeArrayGetDim@4
_XpcsSafeArrayGetElement@12
_XpcsSafeArrayGetElemsize@4
_XpcsSafeArrayGetIID@8
_XpcsSafeArrayGetLBound@12
_XpcsSafeArrayGetUBound@12
_XpcsSafeArrayGetVartype@8
_XpcsSafeArrayLock@4
_XpcsSafeArrayPtrOfIndex@12
_XpcsSafeArrayPutElement@12
_XpcsSafeArrayRedim@8
_XpcsSafeArraySetIID@8
_XpcsSafeArrayUnaccessData@4
_XpcsSafeArrayUnlock@4
_XpcsSetErrorInfo@4
_XpcsStringFromCLSID@8
_XpcsStringFromGUID2@12
_XpcsStringFromIID@8
_XpcsTaskMemAlloc@4
_XpcsTaskMemFree@4
_XpcsTaskMemRealloc@8
_XpcsUninitialize@0
_XpcsUnixTimeToVarTime@8
_XpcsUnregisterClass@4
_XpcsUnregisterClassObject@4
_XpcsUnregisterServer@4
_XpcsVarChangeType@12
_XpcsVarClear@4
_XpcsVarCopy@8
_XpcsVarInit@4
_XpcsVarTimeToUnixTime@12
_XptlAdvise@16
_XptlComPtrAssign@8
_XptlComQIPtrAssign@12
_XptlFreeMarshalStream@4
_XptlGetVersion@4
_XptlInternalQueryInterface@16
_XptlMarshalPtrInProc@12
_XptlModuleAddTermFunc@12
_XptlModuleGetClassObject@16
_XptlModuleInit@12
_XptlModuleLoadTypeLib@16
_XptlModuleRegisterClassObjects@12
_XptlModuleRegisterServer@12
_XptlModuleRegisterTypeLib@8
_XptlModuleRevokeClassObjects@4
_XptlModuleTerm@4
_XptlModuleUnRegisterTypeLib@8
_XptlModuleUnregisterServer@8
_XptlModuleUnregisterServerEx@12
_XptlSetErrorInfo@28
_XptlUnadvise@12
_XptlUnmarshalPtr@12
_XptlWaitWithMessageLoop@4
Sections
.text Size: 560KB - Virtual size: 559KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 112KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE